@mdalacu 

In your topology, you should disable 802.1x for port A1 and port B5. Because your switch A need to communicate with radius server.

You can enable 802.1x for other ports on switch A, the clients connected to those ports need to be authorized.

@Andone Yes, this is my real problem because switch A is not in a secure space...I need to authenticate port B5 with A1..is this possible with Tplink switches? On other brands you can designate a port to be supplicant for anoter 8201.x NAS client...

@mdalacu So, no other ideeas for how can i achive this? 
Thanks

@mdalacu 

I remember that Cisco also recommend to disable 802.1x for the port which connected to anoter 8201.x NAS client.

And when you disable 802.1x for Port B5 and Port A1, and enable 802.1x for other ports, your network is still working safely. Because all devices connected to switch A need to be authorized. Disable 802.1x for Port B5 and Port A1 just for let the 802.1x authentication information can pass switch A and switch B to radius server, otherwise, the authentication data will be blocked.  

Actually I think there are two ways, you can disable 802.1x for Port B5 and Port A1, you also can enable 802.1x for Port B5 and disable 802.1x for all ports of switch A. But switch B need to support 802.1x authentication based MAC address, then every devices connected to switch A need to be authorized as well. 

@Andone Yes, this could be a solution "But switch B need to support 802.1x authentication based MAC address, then every devices connected to switch A need to be authorized as well"

The problem is that FreeRadius implementation in pfSense is expecting MAC password and username to be in format xx-xx-xx-xx-xx-xx and TPLink Switches sent this like XXXXXXXXXXXX. I need to find the right file to patch this..:/

Thanks for your answer...still digging!

If you use MAB, then you need to set MAC password and username to be in format xx-xx-xx-xx-xx-xx. MAB is usually used for the device which do not support 802.1x client. 

If you set port method as MAC based, then all the clients connected to this switch port need to pass authentication. The clients still need to use 802.1x client to login.

So MAB(MAC authentication bypass) is different from MAC Based port method. Just choose the feature which can meet your demand.

@mdalacu